Cashclaw Email Outreach

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent cold-email outreach helper, with the main caution being that it installs an unpinned npm CLI package.

Before installing, verify the cashclaw npm package and preferably use a pinned, reviewed version in a least-privileged environment. The skill content itself is outreach-focused and includes compliance guardrails, but the external CLI package is outside the reviewed artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–18
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

json

"requires": { "bins": ["node"] },
"install": [
  {
    "id": "npm",
    "kind": "node",
    "package": "cashclaw",
    "bins": ["cashclaw"],
    "label": "Install CashClaw via npm"
  }
]

Technical Analysis

The skill instructs its host to install the cashclaw package from npm without specifying an exact version, integrity hash, lockfile, or verified source revision. The audited project does not contain the dependency's source code, so its effective behavior cannot be assessed from the repository.

Package resolution can therefore select a mutable release that differs from the version originally intended or reviewed. npm packages may also define lifecycle scripts that execute during installation. If the registry package, publisher account, or release process is compromised, attacker-controlled code could run with the privileges of the account performing the installation.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious version under the existing cashclaw package name.
3. A user installs this skill, and the unversioned dependency resolves to the malicious release.
4. npm downloads the package and may execute attacker-controlled lifecycle scripts during installation.
5. The user or agent subsequently invokes the installed cashclaw binary through the documented workflow, providing an additional code-execution opportunity.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the process installing or running the package. Depending on those privileges and the host environment, the malicious dependency could access local files and environment variables, modify user-owned data, make network requests, or execute additional proce ...[truncated 308 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cashclaw to an exact, reviewed version rather than allowing mutable package resolution.
2. Record and verify the package's registry integrity hash using a committed lockfile or equivalent trusted metadata.
3. Verify package ownership, provenance, signatures, and release history before installation.
4. Install with lifecycle scripts disabled, such as npm install --ignore-scripts, unless those scripts are required and have been separately audited.
5. Prefer bundling reviewable source code or referencing an immutable, version-locked source commit.
6. Run installation and CLI execution under a least-privileged account in a sandbox with restricted filesystem and network access.
7. Add automated dependency monitoring and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.